fix: render valid CORS Nginx directives

src/Cors/Origin.php

@@ -19,7 +19,7 @@ final class Origin
         $parts = parse_url($origin);
         if (false === $parts
             || !isset($parts['scheme'], $parts['host'])
-            || isset($parts['user'], $parts['pass'], $parts['query'], $parts['fragment'])
+            || isset($parts['user']) || isset($parts['pass']) || isset($parts['query']) || isset($parts['fragment'])
             || (isset($parts['path']) && '/' !== $parts['path'])
         ) {
             throw new InvalidArgumentException(sprintf('Invalid CORS origin: %s', $origin));

src/EventHandler/NginxConfiguration.php

@@ -56,8 +56,9 @@ final readonly class NginxConfiguration
             # The allowlist is emitted as exact Origin matches. Nginx omits an
             # add_header with an empty value, so missing/disallowed Origins do not
             # receive Access-Control-Allow-Origin. This applies after X-Accel.
-{$corsOriginRules}            add_header Access-Control-Allow-Origin $ondemand_hls_cors_origin always;
-            add_header Vary $ondemand_hls_cors_vary always;
+        {$corsOriginRules}
+            add_header Access-Control-Allow-Origin \$ondemand_hls_cors_origin always;
+            add_header Vary \$ondemand_hls_cors_vary always;
             add_header Cache-Control "private, no-store, max-age=0" always;
             add_header X-Content-Type-Options "nosniff" always;
             alias {$assetDirectory};